//诈骗简化案例
//返回 用户点、子图、统计诈骗特征情况三元组
match (d:Device{high_risk:True})
with d, rand() as r order by r limit 1

MATCH (u:User)-[has:has]->(p:Phone)
WHERE  date(p.activation_date) >= date() - duration({months: 12*9})
AND (p)-[:use_device]->(d)

WITH u, has, p,
  count{(p)-[]-(:Phone)} AS callCnt,
  count{(p)-[]->(:Phone)} AS calltoCnt,
  count{(p)<-[]-(:Phone)} AS callfromCnt
WHERE calltoCnt * 100 / callCnt > 70

MATCH (p)-[short_forien_call:called]-(op:Phone)
WHERE short_forien_call.call_duration_minutes < 10
  AND short_forien_call.roaming_type = '国际'
WITH u, has, p,
  collect(short_forien_call) AS cs,
  collect(op)[0..60] AS ops,
  callCnt,
  calltoCnt,
  callfromCnt,
  count(short_forien_call) AS shortForienCnt
WHERE shortForienCnt * 100 / callCnt > 60

// 构建子图结构
WITH u, p,
  [p] + ops AS allNodes,  // 所有节点：用户手机 + 关联手机
  [has] + cs AS allRels,  // 所有关系：拥有关系 + 通话关系
  callCnt,
  calltoCnt,
  callfromCnt,
  shortForienCnt
match (p)-[use:use_device]->(dall:Device)
// 返回用户及其子图
RETURN {
      callCount: callCnt,
      shortForeignCallCount: shortForienCnt,
      callToPercentage: calltoCnt * 100 / callCnt,
      shortForeignCallPercentage: shortForienCnt * 100 / callCnt
    } as stats, u as orange_u, p as orange_p, allNodes, allRels, dall as orange_dall, use as red_use